Summary
In OpenClaw system.run allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as $\\ + newline + ( inside double quotes. Analysis treated the payload as allowlisted (for example /bin/echo), while shell runtime folded the line continuation into $(...) and executed non-allowlisted subcommands.
Affected Packages / Versions
- Package: npm
openclaw
- Latest published affected version:
2026.2.21-2
- Affected range:
<=2026.2.21-2
- Patched version (planned next release):
2026.2.22
Impact
In deployments that opt into tools.exec.security=allowlist (with ask=on-miss or off), this can bypass approval boundaries and lead to unintended command execution.
Fix Commit(s)
3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9
Remediation
- Upgrade to
2026.2.22 (or newer) when published.
- Temporary mitigation: set
tools.exec.ask=always or tools.exec.security=deny.
Release Process Note
patched_versions is pre-set to planned next release 2026.2.22. After npm release is out, this advisory should be ready for direct publish without additional metadata edits.
OpenClaw thanks @tdjackey for reporting.
References
tdjackey Reporter
Summary
In OpenClaw
system.runallowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as$\\+ newline +(inside double quotes. Analysis treated the payload as allowlisted (for example/bin/echo), while shell runtime folded the line continuation into$(...)and executed non-allowlisted subcommands.Affected Packages / Versions
openclaw2026.2.21-2<=2026.2.21-22026.2.22Impact
In deployments that opt into
tools.exec.security=allowlist(withask=on-missoroff), this can bypass approval boundaries and lead to unintended command execution.Fix Commit(s)
3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9Remediation
2026.2.22(or newer) when published.tools.exec.ask=alwaysortools.exec.security=deny.Release Process Note
patched_versionsis pre-set to planned next release2026.2.22. After npm release is out, this advisory should be ready for direct publish without additional metadata edits.OpenClaw thanks @tdjackey for reporting.
References